DllInstall
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
pikabot_core.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
pikabot_core.dll
Resource
win10v2004-20230703-en
Target
pikabot_core.dll
Size
38KB
MD5
9cd94c8ac5c05061bcd4edb8c1e7f8f4
SHA1
d722c153c9ea0b627b09346f1e9e6deec4c3cbe0
SHA256
11cbb0233aff83d54e0d9189d3a08d02a6bbb0ffa5c3b161df462780e0ee2d2d
SHA512
9eea5545db4bd2c4f898f3ca733af839e710754a417615a926df95279db6b3803c230f0f083e5ac4248c4ed8e67e47f4c7fb5a08c5c042da5ecc2c291a363084
SSDEEP
768:gGiEEBGU4Ly9RWFaoF4Vcps8etdvAgV1N:JiLBWLAWFad8eT4u1N
Processes:
resource | yara_rule |
---|---|
sample | family_pikabot |
Checks for missing Authenticode signature.
Processes:
resource |
---|
pikabot_core.dll |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
DllInstall
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ